Reject directory-shaped skill resource URIs and dot-segment directory children

`_validate_resource_uri_in_skill` now rejects a resource URI ending in `/`,
which names a directory rather than a file, and `validate_directory_result`
now rejects a `.`/`..` child, which is a traversal segment rather than a real
direct child. Both slipped past the prior checks.

Author: vijay

src/mcp/shared/skills.py

@@ -157,6 +157,8 @@ def _validate_resource_uri_in_skill(skill_uri: str, resource_uri: str) -> None:
     resource_parts = urlsplit(resource_uri)
     if not resource_parts.scheme or resource_parts.query or resource_parts.fragment:
         raise ValueError(f"resource URI {resource_uri!r} is invalid")
+    if resource_uri.endswith("/"):
+        raise ValueError(f"resource URI {resource_uri!r} names a directory, not a file")
     if skill_parts.scheme != resource_parts.scheme or skill_parts.netloc != resource_parts.netloc:
         raise ValueError(f"resource URI {resource_uri!r} is outside the skill root {skill_uri!r}")
     root = skill_parts.path[: -len("/SKILL.md")]
@@ -257,7 +259,7 @@ def validate_directory_result(uri: str, result: ReadDirectoryResult) -> None:
         if child.scheme != scheme or child.netloc != netloc:
             raise ValueError(f"resource {resource.uri!r} is not a child of directory {uri!r}")
         relative = child.path.removeprefix(prefix)
-        if relative == child.path or not relative or "/" in relative:
+        if relative == child.path or not relative or "/" in relative or relative in (".", ".."):
             raise ValueError(f"resource {resource.uri!r} is not a direct child of directory {uri!r}")
         if resource.uri in seen_uris or resource.name in seen_names:
             raise ValueError(f"directory {uri!r} contains a duplicate child {resource.uri!r}")

tests/shared/test_skills.py

@@ -158,6 +158,13 @@ def test_validate_skill_rejects_a_traversal_segment_in_a_resource_uri() -> None:
         validate_skill(skill)
 
 
+def test_validate_skill_rejects_a_resource_uri_with_a_trailing_slash() -> None:
+    """A manifest entry names a file, not a directory: a trailing slash is rejected."""
+    skill = _skill(extra_resources=[_resource("skill://git-workflow/references/")])
+    with pytest.raises(ValueError, match="names a directory"):
+        validate_skill(skill)
+
+
 def test_validate_skill_rejects_a_negative_resource_size() -> None:
     root = "skill://git-workflow/SKILL.md"
     skill = Skill(
@@ -321,6 +328,14 @@ def test_validate_directory_result_rejects_a_grandchild() -> None:
         validate_directory_result("skill://pdf/templates", result)
 
 
+@pytest.mark.parametrize("child_uri", ["skill://pdf/templates/.", "skill://pdf/templates/.."])
+def test_validate_directory_result_rejects_a_dot_segment_child(child_uri: str) -> None:
+    """A `.`/`..` child is a traversal segment, not a real direct child of the directory."""
+    result = ReadDirectoryResult(resources=[Resource(uri=child_uri, name="x")])
+    with pytest.raises(ValueError, match="direct child"):
+        validate_directory_result("skill://pdf/templates", result)
+
+
 def test_validate_directory_result_rejects_a_uri_outside_the_directory() -> None:
     result = ReadDirectoryResult(resources=[Resource(uri="skill://other/file.md", name="file.md")])
     with pytest.raises(ValueError, match="not a child"):